STIIIZY Data Breach Settlement: Claims Due Sept. 10

At a glance

Status

Re-verifying

Defendant

STIIIZY, Inc.

Settlement fund

$2,950,000

Claim deadline

September 10, 2026

No-proof cash option

Yes — Option 1: pro-rata cash + 2 yrs credit monitoring/ID theft insurance (no documentation). Option 2: reimbursement of documented losses, up to $7,500 per individual. or up to 7500

Max documented payout

$7,500

Administrator

Eisner Advisory Group LLC

Official site

www.stiiizydatabreachsettlement.com

Court

United States District Court for the Central District of California

Case number

In Re: STIIIZY Inc. Data Breach Security Litigation, No. 2:25-cv-00490

Last verified September 11, 2026

Key dates

Milestone	Date	What it means
Claim deadline	September 10, 2026(passed)	Last day to file for a payment
Opt-out (exclusion) deadline	August 26, 2026(passed)	Last day to leave the settlement and keep the right to sue
Objection deadline	August 26, 2026(passed)	Last day to object to the terms
Final approval hearing	October 19, 2026(passed)	When the judge decides whether to approve the settlement
Expected payout	Not yet scheduled	Payments are not sent until after final approval and any appeals

Where to file

STIIIZY Data Breach Settlement is administered by Eisner Advisory Group LLC. The only place to file is the official settlement website:

Verify on the official site

www.stiiizydatabreachsettlement.com

Filing is free. No legitimate settlement charges a fee to file a claim.

You cannot file on RecordingLaw.com. We are an independent publisher, not the settlement administrator, and we are not affiliated with any court, agency, or defendant.

STIIIZY, the California cannabis brand and dispensary operator, notified customers in January 2025 that their personal information had been acquired in a cyberattack on a point-of-sale processing vendor used by some of its retail locations. A $2,950,000 class action settlement resolves claims connected to that incident. The claim deadline was September 10, 2026, and it has passed; the settlement is now awaiting a final approval hearing on October 19, 2026. Here is what the settlement covers, where the case stands, and what a realistic payout looks like.

What happened in the STIIIZY data breach

STIIIZY is a California-based cannabis brand and licensed dispensary operator. According to the notice STIIIZY filed with the California Attorney General, dated January 8, 2025, the company was notified on November 20, 2024 by a vendor of point-of-sale processing services for some of its retail locations that accounts with the vendor had been compromised by an organized cybercrime group. The vendor's investigation found that personal information of certain STIIIZY customers processed by the vendor was acquired on or around October 10 to November 10, 2024.

The notice says the incident affected consumer profiles associated with four STIIIZY locations: Union Square and Mission in San Francisco, Alameda, and Modesto. The resulting litigation was consolidated into a single case, In Re: STIIIZY Inc. Data Breach Security Litigation, filed in the United States District Court for the Central District of California, case number 2:25-cv-00490.

The settlement resolves that litigation with a $2,950,000 common fund. It does not resolve every possible legal question about the incident itself, it resolves the claims that were brought in this case, and it does so through a negotiated payment rather than a trial.

Why a dispensary breach carries a risk a typical retailer breach doesn't

STIIIZY's own notice itemizes what was exposed. It says the incident impacted information contained on government-issued identification cards, including drivers' licenses and medical cannabis cards, as well as information related to transactions with its dispensaries. The categories it lists are name, address, date of birth, age, driver's license number, passport number, photograph, the signature appearing on a government ID card, medical cannabis cards, transaction histories, and other personal information. The notice adds that not all of this information was affected for each person.

That list goes well beyond a typical retail breach. A passport number, an ID photograph and an ID signature are harder to change than a card number, and records like transaction histories and medical cannabis cards can link a real name to that person's status as a cannabis purchaser. That combination raises concerns beyond ordinary identity theft. Depending on the person, evidence connecting a name to cannabis purchases can matter to an employer's background check, an immigration proceeding, a professional licensing board, or a federal firearms purchase, since cannabis remains federally restricted regardless of state legality. A credit freeze stops someone from opening a new account in your name. It does nothing to un-expose that kind of association. Because not every category was exposed for every person, if you received a notice from STIIIZY, check your own letter for what applied to you.

Where the case stands right now

The claim deadline for the STIIIZY Data Breach Settlement was September 10, 2026, and it has passed. The deadline to exclude yourself from the settlement or to object to its terms, August 26, 2026, has also passed.

A federal judge still has to grant final approval before any money is paid out. That hearing is scheduled for October 19, 2026. No payout date has been set, and none will be until after the judge signs off and any objections are resolved. If you are looking for a date your payment arrives, that date does not exist yet.

Who is in the settlement class

The official class definition covers all persons whose personally identifiable information or private health information was accessed, compromised, or stolen in the data security incident STIIIZY announced on January 7, 2025.

Class membership turns on whether your information was compromised in that incident, not on whether you remember receiving a letter or email. If you are unsure whether you were covered, the official settlement site is the place to ask.

How much money can you actually get

Lead with the part of this settlement that did not require a documentation packet: eligible class members could enroll in two years of credit monitoring and identity theft insurance at no cost, with no proof of loss required, by filing a claim before the September 10, 2026 deadline.

Alongside that free monitoring, claimants who chose this no-documentation path are also slated to receive a pro-rata cash payment, subject to final approval. The settlement does not publish a fixed dollar estimate for that payment, so this page will not invent one. It is calculated by dividing a portion of the $2,950,000 fund, after fees, costs, and administration expenses are deducted, among everyone who filed a valid claim, so the actual amount depends on how many people came forward.

Claimants with real, documented losses tied to the incident, such as fraud charges or costs paid to deal with identity theft, could instead claim reimbursement of those losses, up to a cap of $7,500 per person. That $7,500 figure is a ceiling, not a typical outcome, and it requires supporting records. Most class members who chose the no-documentation path will see a modest pro-rata payment, not a large one. Treat every number on this page, including the $7,500 cap, as an estimate subject to adjustment, not a guarantee.

What proof you need to file

For the no-documentation option, credit monitoring plus a pro-rata cash payment, claimants did not need to submit records. They attested that they were class members and selected that option.

For the documented-loss option, up to the $7,500 cap, claimants needed records connecting a specific, out-of-pocket loss to this incident, such as statements showing fraudulent charges or receipts for costs you paid to resolve identity theft. The more specific and dated the documentation, the stronger that portion of a claim.

How filing works

Filing happened only on the official settlement website, and the deadline for either option, no-documentation or documented-loss, was September 10, 2026. A claims-made deadline like this one does not reopen after it passes, so a claim that was not filed by then cannot be added now.

If you did file, the official settlement site is where updates on final approval and payment timing will appear.

If you're not sure you were affected, or you want to do more than file a claim

Whether or not you file, freezing your credit at all three bureaus, Equifax, Experian, and TransUnion, is free by federal law and is the single most effective step against someone opening new accounts in your name. It does not conflict with also enrolling in the monitoring this settlement offered; a freeze blocks new credit, monitoring watches your existing accounts and alerts you to activity, and the two work together rather than replacing each other.

If you notice suspicious activity on any account, or you want a personalized recovery plan, IdentityTheft.gov is the federal government's free resource for exactly that. You do not need to be part of any settlement to use it.

For other open recoveries like this one, RecordingLaw tracks active cases at its data breach settlement tracker.

Frequently Asked Questions

Is the STIIIZY data breach settlement still open?

No. The claim deadline was September 10, 2026, and it has passed. The August 26, 2026 deadline to exclude yourself or object has also passed. The settlement is awaiting a final approval hearing scheduled for October 19, 2026.

What caused the STIIIZY data breach settlement?

The settlement resolves litigation over a data security incident STIIIZY announced in January 2025. A vendor that provided point-of-sale processing for some STIIIZY retail locations was compromised, and customer information it processed was acquired on or around October 10 to November 10, 2024. It is pending in the U.S. District Court for the Central District of California, case number 2:25-cv-00490.

Who is eligible for the STIIIZY settlement?

The class covers all persons whose personally identifiable information or private health information was accessed, compromised, or stolen in the data security incident STIIIZY announced on January 7, 2025. Eligibility turns on whether your information was compromised, not on whether you recall getting a notice. The September 10, 2026 claim deadline has passed.

How much money will I get from the STIIIZY settlement?

It depends on which option a claimant chose and how many people filed. The no-documentation option adds a pro-rata cash payment on top of two years of free credit monitoring and identity theft insurance, while documented losses can be reimbursed up to $7,500. Both are estimates from a shared $2,950,000 fund, not guaranteed amounts, and most claimants should expect a modest pro-rata payment rather than the $7,500 ceiling.

Does the STIIIZY settlement include credit monitoring?

Yes. Class members who chose the no-documentation option could enroll in two years of credit monitoring and identity theft insurance at no cost, without submitting proof of loss, by filing a claim before the September 10, 2026 deadline.

Can I still opt out of or object to the STIIIZY settlement?

No. The deadline to exclude yourself from the settlement or object to its terms was August 26, 2026, and it has passed.

When will STIIIZY settlement payments go out?

No payout date has been published. A judge must first grant final approval at a hearing scheduled for October 19, 2026, and no distribution timeline has been published beyond that.

Who is administering the STIIIZY data breach settlement?

Eisner Advisory Group LLC is administering the settlement through the official site, stiiizydatabreachsettlement.com. Some third-party coverage of this case has named a different administrator; the settlement's own site confirms Eisner Advisory Group LLC.

Does a STIIIZY data breach carry risks beyond typical identity theft?

It can. STIIIZY's notice lists name, address, date of birth, age, driver's license number, passport number, photograph, the signature on a government ID card, medical cannabis cards, and transaction histories among the categories compromised, and records linking a name to cannabis purchases can matter beyond identity theft. Not every category was affected for every person, so check your own notice for what applied to you.